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Amendment 

Amendments to the Claims 

Please replace all prior versions and listings of claims with the following listing of 

claims. 

LISTING OF CLAIMS: 

1. (Currently Amended) A computer-implemented system for providing service 
level management in a network, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, wherein each monitoring agent detects one or more events r el ativ e to in 
the respective aspect of operation and generates an alarm as a function of the one or 
more detected events; and 

an alarm correlation agent that receives alarms from the monitoring agents, that 
determines a current state of the service based on alarms originating from the subset of 
the plurality of network components and, that issues one or more instructions to 
autonomously establish a dos i rod desirable state of the service when the current state 
of the service is undesirable. 

2. (Original) The system of claim 1, wherein the monitoring agents comprise at 
least one of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 
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an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

3. (Original) The system of claim 1, wherein the monitoring agents and alarm 
correlation agents comprise reasoning agents. 

4. (Original) The system of claim 3, wherein the reasoning agents comprise one or 
more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

5. (Original) The system of claim 1, comprising: 

an alarm repository to receive the one or more alarms from the monitoring 
agents, wherein the alarm correlation agent reads the alarms in the alarm repository. 

6. (Currently Amended) A computer-implemented system for providing service 
level management in a network, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state, the system comprising: 
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a first monitoring agent that monitors a respective first aspect of operation of the 
network, the first monitoring agent detecting one or more events r e lat i v e to in the first 
aspect of operation and generating an alarm as a function of the one or more detected 
events; 

a second monitoring agent that monitors a respective second aspect of operation 
of the network, different from the first aspect, the second monitoring agent detecting 
one or more events rolativo to in the second aspect of operation and generating an 
alarm as a function of the one or more detected events; 

an alarm repository that receives one or more alarms from each of the first and 
second monitoring agents; and 

an alarm correlation agent that reads the one or more alarms in the alarm 
repository, and that determines a current state of the service from the read one or more 
alarms that originate from the subset of the plurality of network components, wherein 
the alarm correlation agent is operative to issue one or more instructions to 
autonomously establish a dosired desirable state of the service when the current state 
is undesirable. 

7-8. (Cancelled) 

9. (Previously Presented) The system of claim 6, wherein the first and second 
monitoring agents comprise one or more of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 
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a response time monitoring agent to monitor a response time of a 

communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 
a multicomponent monitoring agent comprising an aggregate of any of the above 

monitoring agents. 

10. (Previously Presented) The system of claim 6, wherein the first and second 
monitoring agents and the alarm correlation agent comprise one or more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

11. (Currently Amended) A computer-implemented system for providing service 
level management in a network having at least one monitoring agent to monitor at least 
one aspect of operation and to generate an alarm as a function of one or more detected 
events, wherein the network includes a plurality of network components, and wherein a 
service operates on a subset of the plurality of network components, the service having 
a state, the system comprising: 

an alarm correlation agent that receives alarms from the at least one monitoring 
agent to determine a current state of the service based on alarms originating from the 
subset of the plurality of network components and that issues one or more instructions 
to autonomously establish a dos i r e d desirable state of the service when the current 
state of the service is undesirable. 

12. (Original) The system of claim 11, wherein the alarm correlation agent 
comprises one or more of: 

a rule-based reasoning agent; 
a model-based reasoning agent; 
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a state-transition graph based reasoning agent; a code book reasoning agent; 

and 

a case-based reasoning agent. 

13. (Currently Amended) A computer-implemented method of providing service 
level management in a network, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state, the method comprising: 

monitoring one or more aspects of operation of the network and detecting one or 
more events rolativo to of in the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function of 
the respective detected one or more events; 

determining a relationship between the one or more alarms and determining a 
current state of the service as a function of the relationship between the one or more 
alarms that originate from the subset of the plurality of network components; and 

generating one or more instructions to autonomously establish a d e s i r e d 
desirable state of the service when the current state of the service is undesirable. 

14. (Cancelled) 

15. (Original) The method according to claim 13, further comprising monitoring at 
least one of: 

operation of the network infrastructure; operation of at least one computer 
system on the network; 

traffic on the network; 

operation of at least one application operating on the network; and 
operation of a trouble-ticketing process that receives reports of problems by 
users with respect to operation of the network; 
operation of a device on the network; 
response time of a communication on the network; 
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an aggregate of any of the above. 

16. (Original) The method of claim 13, wherein the generating an alarm comprises 
applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

17. (Original) The method of claim 13, wherein correlating the one or more alarms 
comprises applying at least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

18. (Currently Amended) A computer-implemented method of providing service 
level management in a network, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of network 
components, the service having a state, the method comprising: 

monitoring a first aspect of operation of the network and detecting one or more 
events r e lativ e to in the first aspect of network operation; 

monitoring a second aspect of operation of the network, different from the first 
aspect, and detecting one or more events r el at i v e to in the second aspect of network 
operation; 

generating a first alarm as a function of the detected one or more events r e lativ e 
te in the first aspect of network operation; 
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generating a second alarm as a function of the detected one or more events 
r e lat i v e to in the second aspect of network operation; 

sending the first and second alarms to an alarm repository; 

accessing the first and second alarms from the alarm repository; 

determining a current state of the service as a function of the accessed first and 
second alarms that originate from the subset of the plurality of network components; 
and 

generating one or more instructions to autonomously establish a d e sir e d 
desirable state of the service when the current state of the service is undesirable. 

19. (Cancelled) 

20. (Previously Presented) The method of claim 18, wherein the one or more 
instructions control an operation of the network. 

21 . (Currently Amended) A computer program product comprising: 
a computer readable medium; 

computer program instructions on the computer-readable medium, wherein the 
computer program instructions, when executed by a computer, directs the computer to 
perform a method of providing service level management in a network, wherein the 
network includes a plurality of network components, and wherein a service operates on 
a subset of the plurality of network components, the service having a state, the method 
comprising: 

monitoring one or more aspects of operation of the network and detecting one or 
more events rolat i vo to in the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function of 
the respective detected one or more events; 

determining an association between the one or more alarms that originate from 
the subset of the plurality of network components and determining a current state of the 
service as a function of the association; and 
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generating one or more instructions to autonomously establish a d e s i r e d 
desirable state of the service when the current state of the service is undesirable. 

22. (Cancelled) 

23. (Currently Amended) A computer-implemented system for providing service 
level management in a network, wherein the network includes a plurality of network 
components, and wherein a service operates on a subset of the plurality of 
components, the service having a state, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, wherein each monitoring agent detects one or more events r e lat i v e to in 
the respective aspect of operation and generate an alarm as a function of the one or 
more detected events; 

each monitoring agent including an alarm correlation agent that receives one or 
more alarms from the other monitoring agents for consideration in generating the alarm 
as a function of the one or more detected events; and 

each monitoring agent including a control agent that issues one or more 
instructions regarding the respective aspect of operation of the network in order to 
autonomously establish a d e s i r e d desirable state of the service. 

24. (Previously Presented) The system of claim 23, wherein the monitoring agents 
comprise at least one of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 
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a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the above 
monitoring agents. 

25. (Original) The system of claim 23, wherein the monitoring agents comprise at 
least one of: 

a rule-based reasoning agent; a model-based reasoning agent; 
a state-transition graph based reasoning agent; 
a code book based reasoning agent; and 
a case-based reasoning agent. 

26. (Currently Amended) A computer program product comprising: 
a computer readable medium; 

computer program instructions on the computer readable medium, wherein the 
computer program instructions, when executed by a computer, direct the computer to 
perform a method of providing service level management in a network, wherein the 
network includes a plurality of network components, and wherein a service operates on 
a subset of the plurality of network components, the service having a state, the method 
comprising, for each of a plurality of agents; 

monitoring one or more aspects of the respective operation of the network and 
detecting the one or more events r el at i v e to in the respective one or more aspects of 
operation; 

generating an alarm for the respective aspect of network operation as a function 
of the respective detected one or more events; 

communicating with the other agents to access events or alarms in the 
respective operation of the other monitoring agent that originate from the subset of the 
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plurality of network components, and determining an existence of an association 
between these events or alarms from other monitoring agents in the alarm generated 
for the respective aspect of network operation and determining a current state of the 
service as a function of the association; and 

generating one or more instructions to autonomously establish a d e sir e d 
desirable state of the service when the current state of the service is undesirable. 



-11 - 



